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Abstract 

The role of squeezing in quantum key distribution with continuous 
variables based on homodyne detection and post-selection is investigated 
for several specific eavesdropping attacks. It is shown that amplitude 
squeezing creates strong correlations between the signals of the legitimate 
receiver and a potential eavesdropper. Post-selection of the received pulses 
can therefore be used to reduce the eavesdropper's knowledge of the raw 
key, which increases the secret key rate by orders of magnitude over large 
distances even for modest amounts of squeezing. 

1 Introduction 

Quantum cryptography or quantum key distribution was first proposed nearly 
two decades ago £Q as a method to exploit properties of small quantum systems 
to establish a secret key between a sender (Alice) and a receiver (Bob) which 
is provably secure against attacks by an eavesdropper (Eve). In recent years 
this field has attracted a lot of research and rapid progress has been achieved in 
the theoretical description and in experimental demonstrations. In particular, 
the range over which a secure key can be established has now been extended 
up to 101 km in optical fibres I2HHE] and 23 km in air [SJE1- However, most 
of these systems are based on the transmission of single photons and suffer 
from inefficient and slow single-photon sources and detectors. These technical 
restrictions lead to very low secret key bit rates, e.g. down to 15 bit/s in the 
case of 2 , and to a maximum distance beyond which no secure key can be 
transmitted at all [7j. 

In order to overcome these limitations, a new class of quantum crypto- 
systems has been proposed, where information is encoded in continuous variables 
such as field quadratures [B1II3E31^Bj photon numbers ^2]> or polarisation 
These schemes are based on the transmission of non-classical states of light, i.e. 
squeezed or entangled states, and are restricted to transmission lines with less 
than 50 % loss. 

Very recently, however, it has been shown that quantum key distribution 
can operate over arbitrarily lossy channels using only classical, i.e. coherent, 
quantum states of light. This is achieved by reverse reconciliation techniques 
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[T^| or by post-selection ^1 ^j] . The first quantum crypto-system of this kind 
has already been demonstrated by Grangier and co-workers [17| . 

In this paper, the effect of squeezing on the performance of quantum key 
distribution with post-selection is investigated. For the schemes operating with 
transmission lines with less than 50% loss |H1 El HOI 1111 1121 IT3| , squeezing guar- 
antees that the smaller part of the pulse lost in the transmission or intercepted 
by Eve has much larger quantum uncertainties and thus less information than 
the larger part received by Bob. One therefore might think that for losses larger 
than 50%, where Eve potentially has access to a larger fraction of the pulse than 
Bob, squeezing might act in favour of the eavesdropper. The main purpose of 
this work is to show that squeezing still is beneficial beyond the 50% loss limit 
in post-selection based schemes. 

This work is organised as follows. Section [5] briefly reviews the quantum 
key distribution scheme |lf>| . Then two classes of eavesdropping attacks are in- 
vestigated which clearly demonstrate the merits of using squeezed states. First, 
intercept-resend strategies are analysed in sectional where Eve performs a mea- 
surement on the whole pulse sent by Alice and resends a pulse to Bob according 
to her measurement results. Two specific measurements based on quadrature 
detection and phase detection, respectively, are discussed as well as the optimal 
orthogonal state projection measurement. It is shown that squeezing reduces 
Eve's chances of success with this attack. The second attack, discussed in sec- 
tion 01 is a superior channel attack, where Eve keeps that part of the pulse 
which would normally be lost in the transmission channel from Alice to Bob, 
and transmits the rest of the pulse through a lossless channel to Bob. This kind 
of attack cannot be detected by Alice and Bob. The maximum amount of secret 
information which can be obtained despite Eve's presence is calculated for an 
Eve restricted to quadrature measurements and a lower bound is given for the 
case where Eve is allowed to perform arbitrary measurements. Also for this kind 
of attack squeezing can significantly enhance the secret key rate. Finally, the 
results are summarised in section [5] 

2 Quantum key distribution with homodyne de- 
tection and post-selection 

The scheme presented here is a generalisation of the recent proposal by Namiki 
and Hirano ^EJ > where Alice sends squeezed states instead of coherent (classical) 
pulses. Without the post-selection process the scheme is also equivalent to the 
scheme by Funk and Raymer |12| which is based on the simultaneous transmis- 
sion of two pulses in orthogonal polarisation states obtained from a parametric 
amplification process. It can be shown by a unitary transformation that the 
latter entangled state is equivalent to a product state of a weak amplitude- 
squeezed pulse (corresponding to the pulse sent by Alice here) and a strong 
(phase-squeezed) pulse (the local oscillator used for homodyne detection). 

The scheme works as follows. First, Alice prepares a minimum-uncertainty 
squeezed pulse with field amplitude oto and squeezing parameter r. Both ao and 
r are assumed to be real numbers, r > corresponds to an amplitude-squeezed 
state, r < to a phase-squeezed state, and r — to a coherent state. Alice then 
applies a phase shift 9 € {0, 7r/2, tt, 3tt/2} to the pulse, where 9 — (9 = tt/2) 
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is interpreted as a bit 1 in basis 1 (basis 2) and 9 = it (9 = 3tt/2) as a bit in 
basis 1 (2). The resulting state reads 

\%l> e ) = exp (c^V - a e- i9 a) exp ((re-™ a 2 - re 2l V 2 )/2) |0) (1) 

where a (a,') is Alice's photon annihilation (creation) operator and |0) is the 
vacuum state. 

Next, Alice sends this state to Bob. During this transmission the pulse 
experiences attenuation, that is, a fraction of the pulse is either absorbed by the 
environment or intercepted by Eve. In both cases the transmission is modeled by 
a beam-splitter of amplitude transmission T and reflection i?, where T 2 +R 2 = 1. 
The output mode operators (b, b<) and (e, e^) correspond to the modes in Bob's 
and Eve's detectors, respectively, and are related to the input mode operators 
(a, a 1 ) and the additional (vacuum) input mode (v,v*) of the beam-splitter by 



b \ T R 



e \ -R T I \ v 



(2) 



For the following it is convenient to express the quantum state of the transmitted 
pulse \tpg) in terms of its Wigner quasi-probability function for Bob's (complex) 
measurement variable (3 and Eve's variable e. One finds 

We(fl,e) = ^exp{-2 [e 2r K {a} 2 + e- 2r l {a} 2 ]} 

x exp | -2 \RP + Te\ 2 } (3) 

where 1Z and X denote real and imaginary parts, respectively, and 

a = (Tp-Re)e- l9 ~a Q . (4) 

In the next step of the quantum key distribution protocol, Bob randomly 
decides which of the two basis sets he uses for his detection. If he chooses 
basis 1 he measures the real part (3 r of his variable f3 by homodyne detection, 
otherwise he measures the imaginary part fy. His measurement results follow 
the probability distributions 



Pe(Pr) = I W e (P,e)dl3 i de r de i , (5) 
P e (J3i) = I ' W e (P,e)dp r de r de t . (6) 



If his measurement result fulfills \p r ,i\ < Pc where j3 c is a fixed threshold value, 
Bob tells Alice to disregard this bit. Otherwise he assigns value 1 to his bit if 
Pr,i > 0c or value if /3 r< i < —fl c . This post-selection is the key to allow for 
quantum key distribution over, in principle, arbitrarily large distances |15l . 
Alice and Bob additionally announce their used basis sets and disregard all bits 
where they used different sets. 

After this step, Alice and Bob share a string of bits which in general contains 
some errors and about which Eve has a certain amount of information. Alice 
and Bob then use (classical) error correction and privacy amplification proto- 
cols which leaves them with an identical secret key about which Eve has only 
negligible information. 
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As an example let us assume that Alice sends the state |^>o)> i- e - $ = 0. In 
this case, Bob's probabilities read 



For an amplitude-squeezed state (r > 0), Bob thus finds a Gaussian distribution 
with a narrow width if he measures the quadrature fi r , and a broad width for 
measurements of fii . The probability of finding a bit 1 or in the correct basis 
(basis 1 in the example here) is thus 



[ , , 1 1 I V2(Ta - 0c) 



(9) 



P., - (1 o, 

where $ denotes the usual error function. For r — equations (|7|)- (|1U|I reduce 
to the results found in JHj. The fraction of accepted bits is 

where the factor 1/2 comes from disregarding all bits where Alice and Bob use 
different basis sets, and the bit error rate of accepted bits is 

- P W (12) 



P(0) + P(1) 



The expected amount of Shannon information shared by Alice and Bob per 
accepted bit is obtained by averaging over Bob's measurement outcomes, 

x {1 + S(0 r ) log 2 5(Pr) + (1 - S(P r )) log 2 (l - 5(P r ))} (13) 

where 

is the bit error rate conditioned on Bob's measured value of /3 r . Thus the average 
information gain per transmitted bit is 

Gab = r acc I AB . (15) 

An example for the quantities I|ll [l -p5 [l as a function of the threshold value 
0c is shown in figure ^ F° r the chosen parameters and for C — 0, half of all 
transmitted bits are accepted, but the bit error rate is relatively large and thus 
the information Iab per accepted bit is low. Increasing C reduces r acc but 
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Figure 1: Quantum key distribution over a lossless channel: acceptance rate 
face (clotted line), bit error rate S per accepted bit (dash-dotted), information 
per accepted bit Iab (dashed) and average information gain per transmitted bit 
Gab (solid line). The parameters are ao = 0.6, r = 0, T = 1. 

also decreases the bit error rate. The figure shows that the average information 
gain Gab per bit decreases with increasing (3 C . It therefore seems advantageous 
for Bob to set /3 C = 0. However, in a realistic setup Alice and Bob will try to 
optimise the secret key bit rate, i.e. the difference between their shared infor- 
mation and the information leaked to Eve. This subject will be discussed later 
in section 21 Note that due to the form of the expressions J^J, 1101) the qualita- 
tive behaviour of the quantities plotted in figure ^ is the same for all squeezing 
parameters r and transmission coefficients T. 

3 Intercept-resend attacks 

In this section I will investigate the security of the protocol against eavesdrop- 
ping attacks where Eve intercepts each pulse, performs a measurement on it, and 
then sends a pulse to Bob in the state which she thinks was initially prepared 
by Alice. First, two specific eavesdropping strategies based on simultaneous 
measurements of both quadrature components and on phase measurement, re- 
spectively, will be analysed. In the third subsection the ideal intercept-resend 
attack will be constructed based on general quantum measurement theory. 

In the following I will concentrate on Eve's probability p CO rr to guess cor- 
rectly the bit and the basis of Alice's pulse. With probability 1 — p cor r, Eve 
will thus transmit a pulse to Bob that differs from the original one, which Alice 
and Bob can detect by an increase of the bit error rate 5 or, for example, by 
a change of the distribution of Bob's measured quadrature components or the 
measured value of r acc . 

3.1 Simultaneous quadrature measurement 

For the first attack investigated here let us assume that Eve splits each pulse 
into two parts on a 50-50 beam-splitter, measures one quadrature component 
in one output arm, and simultaneously the orthogonal quadrature component 
in the other arm. 
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Eve's measurement results are described by the expressions derived in sec- 
tion [3 if T = R = l/\/2 and assuming that Eve performs measurements on 
both output arms of the beam-splitter . Specifically, let us assume that Eve 
measures (3 r and ej. The joint probability distribution is given by 

P e (P r ,e t ) = I 'w 9 (/3,e)dPide r (16) 

which for all parameters factorises into two independent probability distribu- 
tions 

Po(/3 r ,e i )=P e (l3 r )Pe(e i ). (17) 
For = 0, Pe(Pr) is given by equation J7J and 

_ ^{-^} 

V ; Vtt VT 12 + R 2 e 2r V ' 

with T 2 = R 2 = 1/2. 

If Eve's measurement outcome is (/3 r , £j) she will attribute the pulse to the 
value € {0, tt/2, 7t, 37r/2} for which Pg((3 r ,ei) is maximum. For r < this 
yields = for /?,. > |e»], = tt/2 for e, > |/3 r |, = tt for -j3 r > |e;|, 9 = 3tt/2 
for — 6{ > \p r \. For r > 0, which is the interesting case for the purpose of this 
work, finding the most probable value of 9 is more complicated. Let us assume 
that Eve finds r ,ei > 0. She will then attribute this result to 9 = if 

\/2a V2a 

= €i or 

1 - e- 2r 1 - e- 



d< Pr < ~ a or 1 _ _ 2r - e i < Pr < <h- (19) 



The remaining areas in the quadrant (3 r , > are attributed to 9 = tt/2, and 
the results for the other three quadrants of (f3 r ,ei) follow by symmetry. Eve's 
rate of success for this attack is thus given by 



p corr = 2 P (p r ,e t )dp r dei (20) 

JAo 

where Aq is the area defined by 1)19(1 . 

Figure [21 shows the efficiency of the simultaneous measurement attack for 
various parameters. For any given post-selection threshold (3 C and squeezing 
parameter r, Alice adjusts the mean amplitude ao such that S = 1CP 3 for lossless 
transmission and without Eve's interference. The values for ao for r = and 
r = 0.5 are shown in figure Efa) together with the resulting fraction of accepted 
bits r acc (the abscissa of the plot is scaled such that this curve is identical for 
all values of r). The dashed lines in figure Hfb) show Eve's probability p CO rr of 
success for r = and r = 0.5. For any amount of squeezing, Bob can decrease 
Eve's success rate by increasing j3 c . The reason for this is that larger post- 
selection thresholds allow for the use of weaker pulses, see figure (a), which in 
turn gives larger overlaps of the pulses corresponding to different values of 9 in 
Eve's measurement. However, larger thresholds also lead to lower bit acceptance 
rates and thus slower secret key generation. The use of squeezed pulses helps 
to reduce this problem, since in this case already low values of (3 C lead to a low 
probability of success for Eve's attack. This is due to the lower intensity of the 
pulses sent by Alice and the increased uncertainty in the quadrature components 
measured by Eve because of the vacuum noise on the second input port of Eve's 
beam-splitter. 
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Figure 2: Intercept-resend attack for different post-selection thresholds f3 c and 
varying squeezing, (a) Choice of ao for r = (solid line) and r = 0.5 (dashed) 
such that S = 1CP 3 . Dotted line is the corresponding fraction r acc of accepted 
bits, (b) Eve's success rate p CO rr for simultaneous quadrature measurements 
(dashed lines), phase measurements (dash-dotted), and optimised state projec- 
tion measurements (solid). 



3.2 Phase measurement 

Using simultaneous quadrature measurement, Eve obtains estimates for the am- 
plitude and phase of each pulse. However, in the scheme discussed here the 
amplitude of all states \ipg) is the same and Eve is in fact only interested in 
measuring the phase. A better eavesdropping attack might therefore be based 
on an adaptive phase measurement |18j which uses heterodyne detection with 
nonlinear feedback and which in certain limits can approach the optimal mea- 
surement of the phase of a single pulse. 

The distribution of the phase 4> <E [0, 2ir) detected by an optimal phase 
measurement on a state \ipg) is given by 

W) = ^K#MI 2 (2i) 



where 



n=0 



in<f> 



|0). (22) 



If Eve measures a certain phase 4>, she will attribute this result to that state \i/jg) 
for which Pg(4>) is maximum. The success rate of this eavesdropping strategy 
is thus 



Pcorr= / P (23) 
iFo 



where 



Fq = |0|PoW>) > max(P w/ a(0,P*fa),Pjhr/2W))} ■ (24) 

Evaluation of equation (|21|l in the Fock basis and subsequent numerical 
integration of (|2*3^l yield the results shown by the dash-dotted curves in figure 
12 Compared to the simultaneous quadrature measurement discussed above the 
phase measurement leads to a larger success rate p corr for Eve. However, the 
qualitative behaviour is similar. In particular, squeezing is found to reduce the 
eavesdropping efficiency significantly also for phase measurements. 



3.3 Orthogonal state projection 

In the scheme presented here, each pulse sent by Alice is one of the four linearly 
independent and non-orthogonal states \i/jg). For this particular case, Eve's 
ideal measurement, i.e. the one which gives the largest value oi p corr , is known 
to be a projection measurement on four orthogonal states in the Hilbert space 
H s spanned by the four states \if)g} [T2|. Such a projection measurement is 
extremely difficult to realise experimentally, but theoretical proposals for situa- 
tions involving only two coherent states exist, see e.g. [2D]- 

In the following I will construct the optimal projection measurement. For 
this it is necessary to find four orthogonal states \<p$), € {0, 7r/2, it, 3tt/2}, 
which maximise 

2W=~^Kw|<M| 2 - (25) 
6 

Since the states \ifig) are obtained from a single state by the phase shift oper- 
ator U = exp(i7rGJ a/2), it can be assumed that the states \ip$) obey the same 
symmetry, that is, 

\<Pe+n/i) = U\<pe). (26) 
The operator U has the eigenvalues ±1 and ±i. Let \u v ), v S {±1, ±i}, denote 
the corresponding ortho-normal eigenvectors in Tl s . Then, the states \<pg) can 
be written as 

l^ ) = ^r,<toA u v)- (27) 

V 

The orthogonality and normalisation of the states \tpg) together with equation 
(I26[l implies \qg M \ = 1/2. In order to maximise K^elV'e)! an d therefore p CO rr the 
complex phases of qg >v are obtained (up to a global phase) as 

1 MM r9S x 

2 \{UuWe)\ 

The states \u v ), \ipe) and therefore the optimal value of p CO rr can be obtained 
numerically for given parameters ckq and r. It has also been checked that the set 
of states | ipg) constructed in this way yields the optimal orthogonal projection 
measurement even without the a priori requirement of the symmetry (|26H . 

Results of this optimal intercept-resend attack for two values of r are shown 
by the solid curves in figure Efb). As expected, Eve's rate of success p cor r is 
larger for this attack than for either of the two attacks analysed above for all 
parameters. Increasing the post-selection threshold (3 C reduces p corr to below 
70% for coherent as well as squeezed states for the parameters shown in the 
figure. Using squeezed states allows to use lower thresholds and therefore to 
obtain larger acceptance rates r acc . 

However, it is important to note that for too small values of «0j corre- 
sponding to larger (3 C in figure [2 squeezing increases p cor r and thus helps the 
eavesdropper. This can be understood in the following way. Without squeez- 
ing (r = 0) and in the limit of ao — > 0, all four states \ipg) become identical 
to the vacuum state. Eve's probability of guessing bit and basis correctly thus 
approaches 1/4. For squeezed states, on the other hand, |^>o) an d IV^) approach 
the vacuum state squeezed by r in the a + a^ quadrature, but IVv/2) and \ip3 W /2) 
approach the vacuum state squeezed by r in the a — quadrature. Thus, Eve 
can still detect the basis (but not the bit) in which a pulse was sent with large 
probability. For example for r = 0.5 this gives p cor r ~ 0.4. 
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4 Superior channel attack 



In the second class of eavesdropping attacks discussed in this paper, Eve is 
assumed to possess an ideal quantum memory and a lossless channel. She uses 
a beam-splitter to extract that part of the pulse which would normally be lost 
in the transmission channel from Alice to Bob, stores it in her quantum memory 
and sends the rest of the pulse through the lossless channel to Bob. She then 
waits for Bob's public announcement which basis he used and afterwards she 
performs a measurement on her part of the pulse. This kind of attack cannot 
be detected by Alice and Bob since Eve's interference is indistinguishable from 
the standard transmission loss. 

Since Alice and Bob cannot infer Eve's presence from their data, they have 
to assume the worst case and therefore attribute all of their transmission losses 
to Eve. In order to establish a secure key it is necessary to derive an upper 
bound of the information available to Eve, such that in the final stage of the 
protocol Eve's knowledge about the key can be reduced to arbitrarily low levels 
using privacy amplification. Here I will derive such an upper bound following 
the lines of Liitkenhaus [2U 13 • 

4.1 Quadrature measurement 

In a first step I will assume that Eve uses only linear optics for her measure- 
ment, that is, after Bob's public announcement of his basis Eve uses a balanced 
homodyne detector to measure the correct quadrature component of her part 
of the pulse. 

The fundamental quantity of the following derivation is the joint measure- 
ment probability Pg((3 r7 e r ) 



that Bob obtains the value [3 r and simultaneously Eve obtains e r when Alice 
sends a pulse \ipe)- For 9 = this can be evaluated as 



For coherent states, r = 0, this can be factorised and hence Bob's and Eve's 
measurements are independent. For squeezed states, on the other hand, the 
joint probability distribution does not factorise and the two measurements are 
correlated. In particular, for r > as depicted in figure |3 the measurements 
are anti-correlated, that is, if Bob measures a relatively large value of /3 r , Eve 
is likely to measure a small value of e r . Hence, by choosing a larger post- 
selection threshold Bob can increase Eve's bit error rate and thus reduce Eve's 
information. 

Assuming ideal error correction and privacy amplification, a lower bound for 
the gain of secret information per transmitted pulse is given by |211 [7] 



where r acc is given by (|1 1|) . Iab by Ijl3[l . and the fraction r by which the raw 
key is shortened during privacy amplification is 




(29) 



P (/3 r , ^ = -e r exp {-2 [e 2r (T[3 r - Re r - a ) 2 + (R(3 r + Te r ) 2 ] } . (30) 



Sab = r acc (lAB - t ) 



(31) 



T = l+l0g 2 P c . 



(32) 
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Figure 3: Contour plot of the joint probability distribution P (f3 r ,e r ) with a — 
1, r = 0.5, T 2 = 0.75. The maximum of P {(3 r , e r ) occurs at (3 r = Ta a = y/3/2, 
e r = —Rao = —1/2. 



Here, P c is the collision probability given by [2] 

p= l/\ Po(er\Pc< \[3r\) 2 +PM(3c<\[3r\) 2 . . 

c 2 7 £r P (e r \(3 c < \j3 r \) + P.(e r |/3 C < \/3 r \) W 

and 

P*(e r |/3 C <|/3,|)=/ d[i r Sr 6 }f?»L (34) 



//9.<|/J r | "P(0)+P(1) 

is Eve's probability distribution under the condition that a pulse was sent and 
that Bob accepted the bit in his post-selection. Equation Ij34(l can be evaluated 
analytically, yielding 

1 $ ( /o PcjR 2 + T 2 e 2r ) + e r Tfl(l - e 2r ) - a Te 2r 
2 V Vi^TT 2 ^ 
^ AT &(# 2 + T 2 e 2r ) - e£fl(l - e 2r ) + apTe 2 ^ ) 
2 V Vi? 2 + ^e 2 - J J 

where 

P £r = 1 1 -i-. 36 

For r = 0, this simplifies to Po(er|/3c < |A-|) = Po(e r ) due to the independence 
of Bob's and Eve's measurements. Equations (|13fl and l|33|l must be calculated 
numerically in order to get the secret key bit rate Sab, equation H31(l . 

Figure 0] shows the secret key bit rate Sab as a function of ao and /3 C for 
coherent pulses (r = 0) and for squeezed pulses (r = 0.5). In contrast to the 
average gain of information Gab as shown in figure ^ the amount of secret 
information Sab assumes a maximum for finite values of ao and (3 C . Therefore, 
Alice and Bob can optimise their parameters to achieve the highest key bit 
rate once they have measured the transmission loss R 2 . Moreover, comparing 
figures E{a) and (b) one notes that the maximum of Sab can be increased by 
using squeezed light. This is due to the strong correlations between Bob's and 
Eve's measurements in this case as discussed above. 
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Figure 4: Secret key bit rate Sab versus mean pulse amplitude ao and post- 
selection threshold /3 C for (a) coherent pulses and (b) squeezed pulses with r = 
0.5. Channel transmission is T 2 = 0.75. 



4.2 Lower bound on secret bit rate 

If Eve is allowed to perform any kind of measurement permitted by quantum 
theory on her part of the pulse, the analysis of the achievable secret key rate is 
not so straightforward. In particular, if Alice sends a squeezed state and Bob 
performs a quadrature measurement, Eve's part of the pulse is in a mixed state 
in an infinite-dimensional Hilbert space due to the entanglement created by her 
beam-splitter (|30l) . For such a situation the ideal measurement is not known. 

I will therefore derive an upper bound on Eve's information of the bits shared 
by Alice and Bob by assuming that for each bit Eve knows (i) the basis set used, 
(ii) whether or not Bob has a bit error (Eve might learn this during Alice's and 
Bob's error correction procedure), and (hi) the modulus of the value measured 
by Bob for his chosen quadrature component. 

Let us assume that Alice sends a state in basis 1, i.e. state |^o) or IV^), and 
that Bob measures the real quadrature component f3 r . If there is no bit error 
(case I), Eve knows that her state is one of the two states 

\Xi+)=B(\f3r\\i>a), \xi-)=B(-\Pr\\fl>«), (37) 

where | ± (3 r ) b is the quadrature eigenstate corresponding to ±/3 r in Bob's 
Hilbert space. This occurs with probability (1 — 5(fl r ))P(\/3 r \), where S((3 r ) is 
given by (|14|) and P(|/3 r |) is the probability of finding \{3 r \ in a post-selected 
sample of pulses, 

pm) - m + W) ' ( } 

In case of a bit error in Bob's detection (case II), Eve finds one of the two states 

\XlX+)=B{\Pr\\$*), \XlI-)=B{-\Pr\\lh). (39) 

The probability for this case is 5((3 r )P(\f3 r \). In both cases, Eve is left with the 
task to distinguish between two non-orthogonal states. She thus can perform an 
ideal orthogonal projection measurement similar to the one discussed in section 
13.31 which minimises her bit error rates <5/(|/3 r |) and 8u(\ft r \), respectively, to 

m 

SiMlPrl) = \ (i - ^1-|(X/J/+|X/J/-}| 2 ) • (40) 
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Figure 5: (a) Threshold (3 C and pulse amplitude ao (inset) for maximum secret 
key rate Sab versus transmission loss R 2 . (b) Corresponding values of Sab- 
Solid curves are for r = 0, dashed curves for r = 0.5, dotted curves for r = 2. 

The collision rate P c for this kind of attack can now be obtained by averaging 
over all initial states and all measurement results [21]. The result is given by 

Pc = j dP r P{\0r\){(l ~ S(f3 r )) [^(|/3 r |) 2 + (1 - <5/(|/3,|)) 2 ] 

+6([3 r ) [6 n (\p r \) 2 + (1 - SMI)) 2 ] }• (41) 

Let us now investigate the maximum secret key bit rate (1311) using the col- 
lision rate lj41|) as a function of the channel loss and the amount of squeezing. 
To this end Sab is optimised numerically with respect to «o and f3 c for various 
values of r and R 2 . 

Figure shows the optimised values of ao, (3 C and Sab for three different 
values of r as a function of the loss R 2 . Generally, ao is of the order of 1 and is 
slightly decreasing with increasing loss for coherent states (r = 0) and weakly 
squeezed states (r = 0.5). For strong squeezing (r = 2) there is a maximum of 
ao at around R 2 w 0.6. The ideal post-selection threshold (3 C , on the other hand, 
is always increasing from close to zero at low losses to values of approximately 
3 at R 2 = 0.96. The maximum of Sab is close to 0.5 at low loss, decreases 
relatively slowly for moderate losses and drops dramatically for high losses of 
about 85-90%. Using weakly squeezed light increases Sab, i n particular for 
large values of R 2 . 

For strong squeezing and small R 2 , the lower bound for the secret informa- 
tion derived here decreases below the result for coherent (r = 0) states. In this 
limit, the entanglement between Bob's and Eve's states becomes very strong 
and thus the additional assumption (hi), i.e. assuming Eve knows |/3 r |, signifi- 
cantly enhances her detection efficiency and therefore reduces Sab- By contrast, 
in the absence of squeezing Eve's pulse is independent of Bob's measurement 
result and always in one of two possible coherent states which she can discrim- 
inate efficiently by a two-state orthogonal projection measurement. Therefore, 
the above estimate of a lower bound on the secret information is in fact a tight 
bound for r = 0, but it over-estimates Eve's information for large squeezing. 

The effects of squeezing are even more apparent in figure El where Sab is 
plotted as a function of r for fixed loss rates. In all cases, Sab increases with 
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Figure 6: Maximum secret key rate Sab versus squeezing parameter r. Solid 
curves show the lower bound for transmission losses of R 2 = 0.5, R 2 — 0.75 and 
R 2 = 0.9 (from top to bottom). Dashed lines show the corresponding results 
when the eavesdropper is restricted to quadrature measurements. 

increasing r, reaches a maximum for r ~ 1 and decreases again for large values 
of r as discussed before. For 50% loss, Sab = 0.026 for r = and 0.085 for 
r = 0.72. For 75% loss, Sab increases approximately from 0.001 to 0.016 at 
r = 0.92, and for 90% loss from 5 x 10" 7 to 6 x 10" 4 at r = 1.2. 

For comparison, the dashed curves in figure[B]show Sab provided that Eve is 
restricted to quadrature measurements as discussed in the previous section. As 
expected, Sab is always above the lower bound shown by the corresponding solid 
curves. However, it can be seen that the secure key rate is only increased by a 
factor of less than two for moderate squeezing with r < 1. Thus the comparably 
simple quadrature measurement appears to be a near-optimal eavesdropping 
strategy. 

5 Summary and conclusions 

In this work, I have investigated the effects of using squeezed pulses of light 
in continuous- variable quantum key distribution with post-selection |15l lift) . 
In this scheme, Alice prepares the pulses in one of four squeezed states corre- 
sponding to the bit values and 1 in two non-orthogonal basis sets. Bob uses 
homodyne detection to measure one of the two orthogonal quadrature com- 
ponents and disregards all bits where his measured value is below a certain 
post-selection threshold. 

In particular, two kinds of eavesdropping strategies have been investigated. 
The first is a capture-resend attack where Eve attempts to guess correctly which 
of the four states was sent by performing a measurement on the whole pulse. 
Linear as well as nonlinear measurements have been discussed and the optimal 
projection operator has been constructed. Using squeezed pulses renders the 
scheme more robust against this kind of attack, as it reduces Eve's chances 
of guessing the correct state of the pulse. In principle, Alice and Bob can 
achieve a similar level of security with coherent pulses, i.e. without squeezing, 
by increasing the post-selection threshold but only at the cost of a smaller key 
bit rate. 

The second eavesdropping strategy considered in this paper is a passive supe- 
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rior channel attack where Eve's interference with the quantum communication is 
indistinguishable from the channel loss. A lower bound has been derived for the 
secure key bit rate which Alice and Bob can obtain by ideal error correction and 
privacy amplification. Here, squeezing introduces strong correlations between 
Bob's and Eve's measurement results. These correlations allow Bob to restrict 
Eve's knowledge about the transmitted bits by the post-selection process. For a 
given channel loss, the secure key bit rate can be maximised by a proper choice 
of the pulse amplitude and of the post-selection threshold. The calculations 
show that already modest amounts of squeezing, such as a squeezing parameter 
of r = 0.5 (approximately 60% squeezing below shot noise), can increase the 
maximum secure key bit rate by over two orders of magnitude for transmission 
losses of 90%, corresponding to transmission through 50 km of optical fibre with 
losses of 0.2 dB/km. 

These two classes of eavesdropping strategies are among the most frequently 
discussed attacks in the literature on quantum cryptography. The intercept- 
resend attack is the most 'classical' attack and one of the very few attacks 
which can be realised with present-day technology, while the superior channel 
attack has been shown to be the ideal eavesdropping strategy for some quantum 
cryptography schemes. I have proven that the scheme discussed here is secure 
against these two attacks. This, however, is no general proof of security. In par- 
ticular active eavesdropping using, for example, an entangling doner which has 
been suggested as an ideal attack for some continuous variable crypto-schemes 
|17| is not included here and requires further analysis. 

In conclusion, this work shows that squeezing is not an essential requirement 
for secure quantum key distribution, in accordance with earlier results (141 1151 
1161 117) . However, it will increase the security of the scheme against several 
specific eavesdropping attacks and can thereby significantly increase the amount 
of secure information transmitted per pulse. 
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